simon987/ngx_http_js_challenge_module
1
0
Fork 0
mirror of https://github.com/simon987/ngx_http_js_challenge_module.git synced 2025-04-04 06:52:58 +00:00
Code Issues Projects Releases Wiki Activity

Merge 8ca88100a42720971052c6f9c7b18c8c65efab34 into da6852df4103492f9136ef814cda0c7d402e0a90

Browse Source
This commit is contained in:
Alex Jarmoszuk 2024-04-12 14:57:28 -04:00 committed by GitHub
commit b88967d820
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 192 additions and 60 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

102
README.md
View File

@ -1,40 +1,64 @@
# ngx_http_js_challenge_module
## ngx_http_js_challenge_module
![GitHub](https://img.shields.io/github/license/simon987/ngx_http_js_challenge_module.svg)
[![GitHub License](https://img.shields.io/github/license/simon987/ngx_http_js_challenge_module.svg)](LICENSE)
[![CodeFactor](https://www.codefactor.io/repository/github/simon987/ngx_http_js_challenge_module/badge)](https://www.codefactor.io/repository/github/simon987/ngx_http_js_challenge_module)
[![Demo Website](https://img.shields.io/badge/demo-website-blue.svg)](https://ngx-js-demo.simon987.net/)
Simple JavaScript proof-of-work based access control for Nginx, designed to provide security with minimal overhead.
[Demo website](https://ngx-js-demo.simon987.net/)
## Features
Simple javascript proof-of-work based access for Nginx with virtually no overhead.
- **Lightweight Integration:** Easy to integrate with existing Nginx installations.
- **Configurable Security:** Flexible settings to adjust security strength and client experience.
- **Minimal Performance Impact:** Designed to operate with virtually no additional server load.
Easy installation: just add `load_module /path/to/ngx_http_js_challenge_module.so;` to your
`nginx.conf` file and follow the [configuration instructions](#configuration).
## Quick Start
<p align="center">
<img width="600px" src="throughput.png"/>
</p>
1. **Installation**
Add the following line to your `nginx.conf`:
```
load_module /path/to/ngx_http_js_challenge_module.so;
```
### Configuration
2. **Configuration**
Use the simple or advanced configurations provided below to customize the module to your needs.
**Simple configuration**
```nginx
## Installation
To install the ngx_http_js_challenge_module, follow these steps:
1. Add the module loading directive to your Nginx configuration file (`/etc/nginx/nginx.conf`):
```
load_module /path/to/ngx_http_js_challenge_module.so;
```
2. Apply the changes by reloading Nginx:
```
nginx -s reload
```
## Configuration
### Basic Configuration
For basic setup, update your server block as follows:
```
server {
js_challenge on;
js_challenge_secret "change me!";
# ...
js_challenge_secret "change me!"; # Ensure to replace this with a strong secret in production
}
```
### Advanced Configuration
**Advanced configuration**
```nginx
For more complex setups, including exemptions for specific paths:
```
server {
js_challenge on;
js_challenge_secret "change me!";
js_challenge_html /path/to/body.html;
js_challenge_html "/path/to/body.html";
js_challenge_bucket_duration 3600;
js_challenge_title "Verifying your browser...";
@ -45,49 +69,51 @@ server {
location /sensitive {
js_challenge_bucket_duration 600;
#...
# Add further customization here
}
#...
}
```
* `js_challenge on|off` Toggle javascript challenges for this config block
* `js_challenge_secret "secret"` Secret for generating the challenges. DEFAULT: "changeme"
* `js_challenge_html "/path/to/file.html"` Path to html file to be inserted in the `<body>` tag of the interstitial page
* `js_challenge_title "title"` Will be inserted in the `<title>` tag of the interstitial page. DEFAULT: "Verifying your browser..."
* `js_challenge_bucket_duration time` Interval to prompt js challenge, in seconds. DEFAULT: 3600
### Parameters
- **js_challenge on|off** Toggle javascript challenges for this config block
- **js_challenge_secret "secret"** Secret for generating the challenges. DEFAULT: "changeme"
- **js_challenge_html "/path/to/file.html"** Path to html file to be inserted in the `<body>` tag of the interstitial page
- **js_challenge_title "title"** Will be inserted in the `<title>` tag of the interstitial page. DEFAULT: "Verifying your browser..."
- **js_challenge_bucket_duration time** Interval to prompt js challenge, in seconds. DEFAULT: 3600
### Installation
1. Add `load_module ngx_http_js_challenge_module.so;` to `/etc/nginx/nginx.conf`
1. Reload `nginx -s reload`
2. Reload `nginx -s reload`
### Build from source
These steps have to be performed on machine with compatible configuration (same nginx, glibc, openssl version etc.)
1. Install dependencies
```bash
```
apt install libperl-dev libgeoip-dev libgd-dev libxslt1-dev libpcre3-dev
```
2. Download nginx tarball corresponding to your current version (Check with `nginx -v`)
```bash
wget https://nginx.org/download/nginx-1.16.1.tar.gz
tar -xzf nginx-1.16.1.tar.gz
export NGINX_PATH=$(pwd)/nginx-1.16.1/
```
wget https://nginx.org/download/nginx-1.25.4.tar.gz
tar -xzf nginx-1.25.4.tar.gz
export NGINX_PATH=$(pwd)/nginx-1.25.4/
```
3. Compile the module
```bash
```
git clone https://github.com/simon987/ngx_http_js_challenge_module
cd ngx_http_js_challenge_module
./build.sh
```
4. The dynamic module can be found at `${NGINX_PATH}/objs/ngx_http_js_challenge_module.so`
### Known limitations (To Do)
* None
### Known limitations / TODO
* Users with cookies disabled will be stuck in an infinite refresh loop (TODO: redirect with a known query param, if no cookie is specified but the query arg is set, display an error page)
* If nginx is behind a reverse proxy/load balancer, the same challenge will be sent to different users and/or the response cookie will be invalidated when the user is re-routed to another server. (TODO: use the x-real-ip header when available)
### Throughput
<p align="center">
<img width="600px" src="throughput.png"/>
</p>

150
ngx_http_js_challenge.c
View File

File diff suppressed because one or more lines are too long